Research disclosure

What it observes

• Request metadata

  Standard server-log fields for requests that reach agentpwn.com: User-Agent, Accept and Referer headers, requested path, and timing. This is the same data any web server records for any visitor.

• Agent fingerprint

  A behavioral score derived from the above (known crawler User-Agents, HTTP client/SDK strings, resource-load and request-sequence patterns) used to distinguish automated agents from human visitors and to select an appropriate difficulty tier.

• Network attribution, at organization granularity

  The source network of the connecting request, resolved to an autonomous system (ASN), organization name, network type (business / hosting / ISP), and coarse network prefix. This describes the network an agent connects from — for example a corporate egress — not a person.

• Volunteered self-report

  If an agent follows an injection payload and reports back, whatever it chooses to state about itself (provider, model, version, framework). This is volunteered by the agent and is treated as unverified.

• Third-party analytics on browser visits

  Pages served to a browser load Google Analytics (measurement ID G-D01D6K9Y34), which records the visit under Google's own terms. It runs only where JavaScript executes, so it does not apply to an agent that fetches a page without running scripts.

What it retains

• Derived attributes only. Source IP addresses are resolved to the organization-level attributes above and are not retained beyond a short processing window. We keep the derived attribution, not the raw address.
• Time-limited interaction content. In the granular interaction log, the per-interaction fields that could carry visitor-identifying or agent-supplied content (the User-Agent, any response an agent sends back, and the Referer) are automatically stripped after 30 days by a daily job. Two derived records are not yet covered by that job and retain a User-Agent for longer: the agent-fingerprint record and the threat-matrix evidence record. We are extending the job to cover both. Beyond the 30-day window we keep the organization-level attribution (network, ASN, technique, difficulty tier, timestamp) and the agent fingerprint.
• Organization granularity. Attribution stops at network / organization. We do not build profiles of, or attempt to identify, individual people.
• Redacted callbacks. If an agent includes content from its own environment in a callback, secret-shaped tokens are stripped and free-form content is truncated before anything is stored. We do not retain exfiltrated content.
• Aggregate, public statistics. The public statistics on this site are sector- and technique-level aggregates. Organization-level attribution is internal to the research and is never published.

What it will never do

• We never reach back into an agent's environment. AgentPwn is passive: it serves content and records who interacts with it. It does not scan, probe, or connect to any system that contacts it, and it does not follow or use any URL, credential, or instruction an agent may leak.
• We never use leaked credentials. If an agent leaks a live secret, it is treated as a matter for responsible disclosure, not use.
• We never identify individuals in this research. Attribution is organization-level by design. This is a statement about what we collect and analyse, not about the third-party analytics tag described above: Google Analytics runs on browser visits under Google's own terms and its identification model is Google's, not ours.
• We never publish who was attributed. Organization-level results stay internal.

Contact

AgentPwn is operated by the OpenA2A project, an unincorporated security-research project based in Colorado, United States. There is no incorporated entity behind it. The controller for this research is Abdel Fane, reachable at info@opena2a.org.

Anyone may ask what has been recorded about a given network, or object to the processing. Attribution here is organization-level, so include the ASN or IP range and an approximate time window; without a network identifier a request cannot be matched to what was recorded. Requests are read and acted on by a person — we do not commit to a fixed response time. There is no automated exclusion list; exclusion is applied by hand on request.

If an agent leaked a live secret to this site, report it at github.com/opena2a-org/opena2a/security/advisories/new. To test your own agent directly, run npx hackmyagent secure.